APKs: permissions, signatures and where the files come from

Android installs nothing without a signature. The official documentation states that all APKs must be digitally signed with a certificate before they are installed or updated, and that certificate carries metadata identifying the holder of the private key. The technical requirement is always met; the identity almost never is. Packages like these come with self-made certificates, test names or blank fields, because anyone can produce one in a minute.

The consequence only bites on the second file. To Android, two packages with the same name and different keys are two programs that do not know each other: one cannot update the other, and the old one must be uninstalled first. When a page tells you to "remove the old version" so the new one will install, what is happening is not an update but a change of publisher, unannounced.

A generative image model takes gigabytes of space and demands video memory. A package of eight or twenty megabytes is not carrying one: it carries an interface and a server address. That is why it is useless without a connection, and why the photo leaves the phone even when the file name implies otherwise. Why that computation cannot happen on-device is explained in the piece on how the original worked and what replaced it.

Size also explains why two copies that look identical from outside can behave differently: what changed is not the program but the address it points at. That server can move, close or change owner without the file knowing, which is why a build that still answered a few months ago suddenly stops without anyone touching it.

This is not unfinished paperwork: Google Play's content policy rules out apps that contain or promote sexual content or pornography and names non-consensual deepfake material separately. The rule belongs to the store. What belongs to this page is what the rule leaves behind on the file side.

With no listing there is no publisher of record, no declared size to check a download against, and no build number that says which copy you are holding. Every check further down this page exists because those three are missing, and every one of them is something you perform on the file yourself rather than something a platform has already done. That is the whole difference between installing from a store and installing from a link.

Android locks down part of its settings when an app does not come from a store, and it says so on screen. Two similar warnings need separating. The first appears when you install something from outside a store and only tells you the system has not checked the file. The second appears when an app asks for accessibility or an equivalent function, and that one is not a formality: Android restricts it precisely because the permission allows reading the screen and pressing buttons on your behalf.

Walking past the first means accepting a risk. Walking past the second means handing over control of the phone. When an app guides you step by step through disabling those protections, it has already told you what it actually needs.

A file that is not sold has to make money another way, and there are two: full-screen ads between every tap, and a weekly subscription billed by a gateway whose name you will not recognise on a statement. Both need the app to stay alive, and that is where the boot permission from the list above finds its purpose.

Compare that with the web side, where the charge is at least readable before you pay: the services with published tariffs and where the sign-up wall appears are described on their own page. And none of this is only a question of money. The page that sets out the risk for the person in the photo takes that side first — a file sent from a phone belongs to somebody who agreed to none of it — and only then counts the weekly charges and the payments that cannot be pulled back.

The law here does not judge the file, it judges the conduct towards a person. The Anti-Photo and Video Voyeurism Act of 2009 prohibits copying or reproducing, selling or distributing, and publishing or broadcasting intimate images of a person taken without consent — including through the internet and mobile phones — and sets three to seven years of imprisonment and a fine of ₱100,000 to ₱500,000. Forwarding a file to a group chat lands inside the words "distribute" and "publish", which many people treat as neutral acts.

Section 12 of the Safe Spaces Act of 2019 adds a broader online provision, covering the uploading and sharing, without the victim's consent, of media containing photos or video with sexual content. And Section 6 of the Cybercrime Prevention Act of 2012 raises the penalty by one degree whenever the act is committed through information and communications technology — which, for anything involving an app, is always.